AI-analyzed release notes for CNCF graduated and incubating projects.
Bearer tokens issued before project creation are rejected. The release also updates dependencies and components and removes payload data from the configuration audit log.
Action needed (1)
securityRejection of bearer tokens issued before project creation
The security enforcement rejects bearer tokens issued before project creation.
This release updates base images, dependencies, and Trivy components, and changes the audit-log payload. It also rejects bearer tokens issued before project creation.
Action needed (1)
securityBearer tokens issued before project creation rejected
The security fix rejects bearer tokens issued before project creation.
This release focuses on dependency maintenance, including a security-related Go update, along with a grace-period behavior change. No operator setup changes are explicitly required beyond upgrading to obtain the security fix.
Action needed (1)
securityGo dependency updates for CVE remediation
The release updates go and its dependencies to address CVEs. The change ships in operator-framework v1.42.1.
A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.
Check if affected (3)
securityCVE-2026-29785 fix for leafnode compression
Applies if leafnode compression is enabled.
securityCVE-2026-27889 fix for WebSockets
Applies if WebSockets are enabled.
breakingThe max_conns server configuration value
Applies if you configure max_conns in the server configuration.
A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.
Check if affected (2)
securityhighCVE-2026-29785 fix for leafnode compression
Applies if CVE-2026-29785 is present and leafnode compression is enabled.
securityhighCVE-2026-27889 fix for WebSockets
Applies if CVE-2026-27889 is present and WebSockets is enabled.
OPA v1.14.1 is a patch release focused on bug fixes and dependency updates. It includes dependency work related to the Go standard library and common package vulnerabilities.
Action needed (1)
securityGolang standard library dependency updates
This patch release collects two bug fixes and dependency updates for the Golang standard library and common package vulnerabilities. The change ships in OPA v1.14.1.
This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.
Action needed (1)
securityThe Go 1. update
Go 1. ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.
A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.
Action needed (1)
securityhighThe Go 1. build dependency and cited security fixes
The build uses Go 1., which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.
Check if affected (2)
securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.
A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.
Action needed (2)
securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.
breakingThe ServerSideApplyPhase1 feature gate default
The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.
Check if affected (2)
breakingKubernetes version support
Applies if you use Kubernetes 1.27, 1.28, or 1.29.
breakingKafka 4.0.0 and 4.0.1 support
Applies if you use Kafka 4.0.0 or 4.0.1.
Plan ahead (1)
deprecatedThe ingress listener type deprecation
Applies if you configure the ingress listener type.
This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.
Check if affected (4)
securityhighCVE-2026-3047 SAML broker authentication bypass
Applies if you use SAML broker and configure a disabled SAML client.
securityhighCVE-2026-3009 disabled identity provider enforcement
Applies if you configure Disabled Identity Provider.
securityhighCVE-2026-2603 disabled SAML IdP broker login
Applies if you configure Disabled SAML IdP.
Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.
Check if affected (1)
securitySecurity fixes for three Backstage packages
Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.
Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.
Check if affected (2)
securityThe http_challenge server node attestor plugin, SSRF issue fixed
Applies if you use http_challenge.
securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed
Applies if you use x509pop.
A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.
Check if affected (2)
securityThe http_challenge server node attestor plugin, SSRF issue corrected
Applies if you use the http_challenge server node attestor plugin.
securityThe x509pop server node attestor plugin, CPU consumption issue corrected
Applies if you use the x509pop server node attestor plugin.
